Update

hardening.yml

@@ -1,4 +1,4 @@
-- hosts: test
+- hosts: monitoring
   # vars:
   become: true
   gather_facts: true
@@ -27,7 +27,7 @@
             state: file
             mode: 0644
 
-        - name: somerepo | apt source
+        - name: Add netbird repo
           ansible.builtin.apt_repository:
             repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
             state: present
@@ -81,26 +81,33 @@
 # chmod go+r /usr/share/keyrings/netbird-archive-keyring.gpg for error:
 #||-----> GPG error: https://pkgs.netbird.io/debian stable InRelease: The following signatures couldn't be verified because the public key is not available
 
-  # roles:
-  #   - robertdebock.update
-  #   - devsec.hardening.os_hardening
-  #   - devsec.hardening.ssh_hardening
-  #   - maxlareo.rkhunter
-  #   - maxlareo.chkrootkit
-  #   - robertdebock.auditd
-  #   - geerlingguy.firewall
-  #   - grog.management-user
-  #   - GROG.user
-  #   - GROG.authorized-key
-  #   - GROG.sudo
-  #   - ansible_unattended_upgrades
-  #   - buluma.lynis
+  roles:
+    - robertdebock.update
+    - devsec.hardening.os_hardening
+    - devsec.hardening.ssh_hardening
+    - maxlareo.rkhunter
+    - maxlareo.chkrootkit
+    - robertdebock.auditd
+    - geerlingguy.firewall
+    - grog.management-user
+    - GROG.user
+    - GROG.authorized-key
+    - GROG.sudo
+    - ansible_unattended_upgrades
+    - buluma.lynis
   
   # roles:
   #   - role: netways.elasticstack.elasticsearch
   #     tags: test2
   tasks:
 
+    - name: Tcheck ssh conf for phone connection 
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/ssh_config
+        insertafter: 'Host '
+        firstmatch: true
+        line: '#!Enable-HMAC-ETM'
+
     - name: Retrieve private IP address netbird
       ansible.builtin.gather_facts:
 
@@ -136,9 +143,9 @@
     #     name: ansible-role-labocbz-install-grafana
     #   when: group_names is search("monitoring") 
 
-    - ansible.builtin.import_role: 
-        name: netways.elasticstack.repos
-      tags: repo
+    # - ansible.builtin.import_role: 
+    #     name: netways.elasticstack.repos
+    #   tags: repo
 
 
 # to reset password
@@ -151,15 +158,15 @@
 # /usr/share/kibana/bin/kibana-encryption-keys generate --force
 # /usr/share/elasticsearch/bin# ./elasticsearch-service-tokens create elastic/kibana token
 # bin/elasticsearch-create-enrollment-token -s kibana --url "https://172.0.0.3:9200"
-    - ansible.builtin.import_role: 
-        name: netways.elasticstack.elasticsearch
-      tags: elastic
+#     - ansible.builtin.import_role: 
+#         name: netways.elasticstack.elasticsearch
+#       tags: elastic
 
 
-# Wait the end install to have th url to connect and put the enroll token
-    - ansible.builtin.import_role: 
-        name: netways.elasticstack.kibana
-      tags: kibana
+# # Wait the end install to have th url to connect and put the enroll token
+#     - ansible.builtin.import_role: 
+#         name: netways.elasticstack.kibana
+#       tags: kibana
 
     # - ansible.builtin.import_role: 
     #     name: netways.elasticstack.logstash
@@ -169,6 +176,6 @@
 # filebeat test config -e filebeat.yml
 # filebeat setup -e
 # restart filebeat
-    - ansible.builtin.import_role: 
-        name: netways.elasticstack.beats
-      tags: filebeat
+    # - ansible.builtin.import_role: 
+    #     name: netways.elasticstack.beats
+    #   tags: filebeat